diff --git a/go.mod b/go.mod
index b43cd0ee2a..4a3e087697 100644
--- a/go.mod
+++ b/go.mod
@@ -19,7 +19,7 @@ require (
 	github.com/containers/libhvee v0.4.0
 	github.com/containers/ocicrypt v1.1.8
 	github.com/containers/psgo v1.8.0
-	github.com/containers/storage v1.48.1-0.20230728131509-c3da76fa3f63
+	github.com/containers/storage v1.49.1-0.20230823084450-6902c2df7cca
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/coreos/stream-metadata-go v0.4.3
 	github.com/crc-org/vfkit v0.1.1
@@ -47,7 +47,7 @@ require (
 	github.com/onsi/gomega v1.27.10
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0-rc4
-	github.com/opencontainers/runc v1.1.8
+	github.com/opencontainers/runc v1.1.9
 	github.com/opencontainers/runtime-spec v1.1.0
 	github.com/opencontainers/runtime-tools v0.9.1-0.20230317050512-e931285f4b69
 	github.com/opencontainers/selinux v1.11.0
diff --git a/go.sum b/go.sum
index e2d5e54339..e2633b5741 100644
--- a/go.sum
+++ b/go.sum
@@ -264,8 +264,8 @@ github.com/containers/ocicrypt v1.1.8/go.mod h1:jM362hyBtbwLMWzXQZTlkjKGAQf/BN/L
 github.com/containers/psgo v1.8.0 h1:2loGekmGAxM9ir5OsXWEfGwFxorMPYnc6gEDsGFQvhY=
 github.com/containers/psgo v1.8.0/go.mod h1:T8ZxnX3Ur4RvnhxFJ7t8xJ1F48RhiZB4rSrOaR/qGHc=
 github.com/containers/storage v1.43.0/go.mod h1:uZ147thiIFGdVTjMmIw19knttQnUCl3y9zjreHrg11s=
-github.com/containers/storage v1.48.1-0.20230728131509-c3da76fa3f63 h1:oHER814v4p86QDV9EKZRSaMmEeC8yWD2wXlFAige1kc=
-github.com/containers/storage v1.48.1-0.20230728131509-c3da76fa3f63/go.mod h1:m9LC8fEm9FcuJ4wOJHYmCqdQUb0f66850wXyen+hh78=
+github.com/containers/storage v1.49.1-0.20230823084450-6902c2df7cca h1:W5cl16PWueRYxe0cbVPJap6QDYYXn41HtbBiztuWJN4=
+github.com/containers/storage v1.49.1-0.20230823084450-6902c2df7cca/go.mod h1:fCvGMWQ0BOvlReQf9DqRAcl73ofTfRXE8l6ifnI4a3g=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
diff --git a/vendor/github.com/containers/storage/.cirrus.yml b/vendor/github.com/containers/storage/.cirrus.yml
index 8ef38e2cd2..00c69d7f12 100644
--- a/vendor/github.com/containers/storage/.cirrus.yml
+++ b/vendor/github.com/containers/storage/.cirrus.yml
@@ -23,7 +23,7 @@ env:
     # GCE project where images live
     IMAGE_PROJECT: "libpod-218412"
     # VM Image built in containers/automation_images
-    IMAGE_SUFFIX: "c20230614t132754z-f38f37d13"
+    IMAGE_SUFFIX: "c20230816t191118z-f38f37d13"
     FEDORA_CACHE_IMAGE_NAME: "fedora-${IMAGE_SUFFIX}"
     DEBIAN_CACHE_IMAGE_NAME: "debian-${IMAGE_SUFFIX}"
 
diff --git a/vendor/github.com/containers/storage/Makefile b/vendor/github.com/containers/storage/Makefile
index 6cb354c2c0..77189d49ea 100644
--- a/vendor/github.com/containers/storage/Makefile
+++ b/vendor/github.com/containers/storage/Makefile
@@ -49,7 +49,7 @@ local-gccgo gccgo: ## build using gccgo on the host
 	GCCGO=$(PWD)/hack/gccgo-wrapper.sh $(GO) build -compiler gccgo $(BUILDFLAGS) -o containers-storage.gccgo ./cmd/containers-storage
 
 local-cross cross: ## cross build the binaries for arm, darwin, and freebsd
-	@for target in linux/amd64 linux/386 linux/arm linux/arm64 linux/ppc64 linux/ppc64le linux/s390x linux/mips linux/mipsle linux/mips64 linux/mips64le darwin/amd64 windows/amd64 freebsd/amd64 freebsd/arm64 ; do \
+	@for target in linux/amd64 linux/386 linux/arm linux/arm64 linux/ppc64 linux/ppc64le linux/riscv64 linux/s390x linux/mips linux/mipsle linux/mips64 linux/mips64le darwin/amd64 windows/amd64 freebsd/amd64 freebsd/arm64 ; do \
 		os=`echo $${target} | cut -f1 -d/` ; \
 		arch=`echo $${target} | cut -f2 -d/` ; \
 		suffix=$${os}.$${arch} ; \
diff --git a/vendor/github.com/containers/storage/VERSION b/vendor/github.com/containers/storage/VERSION
index a6cb1f763b..7a6b3b28e0 100644
--- a/vendor/github.com/containers/storage/VERSION
+++ b/vendor/github.com/containers/storage/VERSION
@@ -1 +1 @@
-1.49.0-dev
+1.49.1-dev
diff --git a/vendor/github.com/containers/storage/drivers/btrfs/btrfs.go b/vendor/github.com/containers/storage/drivers/btrfs/btrfs.go
index 42d55c1a73..fd93d4e84d 100644
--- a/vendor/github.com/containers/storage/drivers/btrfs/btrfs.go
+++ b/vendor/github.com/containers/storage/drivers/btrfs/btrfs.go
@@ -675,8 +675,7 @@ func (d *Driver) Exists(id string) bool {
 
 // List all of the layers known to the driver.
 func (d *Driver) ListLayers() ([]string, error) {
-	subvolumesDir := filepath.Join(d.home, "subvolumes")
-	entries, err := os.ReadDir(subvolumesDir)
+	entries, err := os.ReadDir(d.subvolumesDir())
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/containers/storage/drivers/overlay/overlay.go b/vendor/github.com/containers/storage/drivers/overlay/overlay.go
index 6b6f20637d..061df344ef 100644
--- a/vendor/github.com/containers/storage/drivers/overlay/overlay.go
+++ b/vendor/github.com/containers/storage/drivers/overlay/overlay.go
@@ -820,11 +820,17 @@ func (d *Driver) String() string {
 // Status returns current driver information in a two dimensional string array.
 // Output contains "Backing Filesystem" used in this implementation.
 func (d *Driver) Status() [][2]string {
+	supportsVolatile, err := d.getSupportsVolatile()
+	if err != nil {
+		supportsVolatile = false
+	}
 	return [][2]string{
 		{"Backing Filesystem", backingFs},
 		{"Supports d_type", strconv.FormatBool(d.supportsDType)},
 		{"Native Overlay Diff", strconv.FormatBool(!d.useNaiveDiff())},
 		{"Using metacopy", strconv.FormatBool(d.usingMetacopy)},
+		{"Supports shifting", strconv.FormatBool(d.SupportsShifting())},
+		{"Supports volatile", strconv.FormatBool(supportsVolatile)},
 	}
 }
 
@@ -1879,7 +1885,9 @@ func (d *Driver) Put(id string) error {
 	if !unmounted {
 		if err := unix.Unmount(mountpoint, unix.MNT_DETACH); err != nil && !os.IsNotExist(err) {
 			logrus.Debugf("Failed to unmount %s overlay: %s - %v", id, mountpoint, err)
-			return fmt.Errorf("unmounting %q: %w", mountpoint, err)
+			if !errors.Is(err, unix.EINVAL) {
+				return fmt.Errorf("unmounting %q: %w", mountpoint, err)
+			}
 		}
 	}
 
@@ -2162,7 +2170,7 @@ func (d *Driver) getLowerDiffPaths(id string) ([]string, error) {
 // and its parent and returns the size in bytes of the changes
 // relative to its base filesystem directory.
 func (d *Driver) DiffSize(id string, idMappings *idtools.IDMappings, parent string, parentMappings *idtools.IDMappings, mountLabel string) (size int64, err error) {
-	if d.options.mountProgram == "" && (d.useNaiveDiff() || !d.isParent(id, parent)) {
+	if !d.isParent(id, parent) {
 		return d.naiveDiff.DiffSize(id, idMappings, parent, parentMappings, mountLabel)
 	}
 
diff --git a/vendor/github.com/containers/storage/drivers/quota/projectquota.go b/vendor/github.com/containers/storage/drivers/quota/projectquota.go
index 10ea3c5a56..2be79698d3 100644
--- a/vendor/github.com/containers/storage/drivers/quota/projectquota.go
+++ b/vendor/github.com/containers/storage/drivers/quota/projectquota.go
@@ -58,6 +58,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"sync"
 	"syscall"
 	"unsafe"
 
@@ -83,7 +84,7 @@ type Quota struct {
 type Control struct {
 	backingFsBlockDev string
 	nextProjectID     uint32
-	quotas            map[string]uint32
+	quotas            *sync.Map
 	basePath          string
 }
 
@@ -168,7 +169,7 @@ func NewControl(basePath string) (*Control, error) {
 	q := Control{
 		backingFsBlockDev: backingFsBlockDev,
 		nextProjectID:     minProjectID + 1,
-		quotas:            make(map[string]uint32),
+		quotas:            &sync.Map{},
 		basePath:          basePath,
 	}
 
@@ -191,7 +192,11 @@ func NewControl(basePath string) (*Control, error) {
 // SetQuota - assign a unique project id to directory and set the quota limits
 // for that project id
 func (q *Control) SetQuota(targetPath string, quota Quota) error {
-	projectID, ok := q.quotas[targetPath]
+	var projectID uint32
+	value, ok := q.quotas.Load(targetPath)
+	if ok {
+		projectID, ok = value.(uint32)
+	}
 	if !ok {
 		projectID = q.nextProjectID
 
@@ -203,7 +208,7 @@ func (q *Control) SetQuota(targetPath string, quota Quota) error {
 			return err
 		}
 
-		q.quotas[targetPath] = projectID
+		q.quotas.Store(targetPath, projectID)
 		q.nextProjectID++
 	}
 
@@ -217,7 +222,7 @@ func (q *Control) SetQuota(targetPath string, quota Quota) error {
 // ClearQuota removes the map entry in the quotas map for targetPath.
 // It does so to prevent the map leaking entries as directories are deleted.
 func (q *Control) ClearQuota(targetPath string) {
-	delete(q.quotas, targetPath)
+	q.quotas.Delete(targetPath)
 }
 
 // setProjectQuota - set the quota for project id on xfs block device
@@ -297,8 +302,11 @@ func (q *Control) GetDiskUsage(targetPath string, usage *directory.DiskUsage) er
 
 func (q *Control) fsDiskQuotaFromPath(targetPath string) (C.fs_disk_quota_t, error) {
 	var d C.fs_disk_quota_t
-
-	projectID, ok := q.quotas[targetPath]
+	var projectID uint32
+	value, ok := q.quotas.Load(targetPath)
+	if ok {
+		projectID, ok = value.(uint32)
+	}
 	if !ok {
 		return d, fmt.Errorf("quota not found for path : %s", targetPath)
 	}
@@ -380,7 +388,7 @@ func (q *Control) findNextProjectID() error {
 			return err
 		}
 		if projid > 0 {
-			q.quotas[path] = projid
+			q.quotas.Store(path, projid)
 		}
 		if q.nextProjectID <= projid {
 			q.nextProjectID = projid + 1
diff --git a/vendor/github.com/containers/storage/pkg/chunked/storage_linux.go b/vendor/github.com/containers/storage/pkg/chunked/storage_linux.go
index 36abe27730..088c92782c 100644
--- a/vendor/github.com/containers/storage/pkg/chunked/storage_linux.go
+++ b/vendor/github.com/containers/storage/pkg/chunked/storage_linux.go
@@ -164,26 +164,6 @@ func copyFileContent(srcFd int, destFile string, dirfd int, mode os.FileMode, us
 	return dstFile, st.Size(), nil
 }
 
-// GetTOCDigest returns the digest of the TOC as recorded in the annotations.
-// This is an experimental feature and may be changed/removed in the future.
-func GetTOCDigest(annotations map[string]string) (*digest.Digest, error) {
-	if contentDigest, ok := annotations[estargz.TOCJSONDigestAnnotation]; ok {
-		d, err := digest.Parse(contentDigest)
-		if err != nil {
-			return nil, err
-		}
-		return &d, nil
-	}
-	if contentDigest, ok := annotations[internal.ManifestChecksumKey]; ok {
-		d, err := digest.Parse(contentDigest)
-		if err != nil {
-			return nil, err
-		}
-		return &d, nil
-	}
-	return nil, nil
-}
-
 type seekableFile struct {
 	file *os.File
 }
diff --git a/vendor/github.com/containers/storage/pkg/chunked/storage_unsupported.go b/vendor/github.com/containers/storage/pkg/chunked/storage_unsupported.go
index cc37ab1d8f..8d3fcf2ba4 100644
--- a/vendor/github.com/containers/storage/pkg/chunked/storage_unsupported.go
+++ b/vendor/github.com/containers/storage/pkg/chunked/storage_unsupported.go
@@ -9,16 +9,9 @@ import (
 
 	storage "github.com/containers/storage"
 	graphdriver "github.com/containers/storage/drivers"
-	digest "github.com/opencontainers/go-digest"
 )
 
 // GetDiffer returns a differ than can be used with ApplyDiffWithDiffer.
 func GetDiffer(ctx context.Context, store storage.Store, blobSize int64, annotations map[string]string, iss ImageSourceSeekable) (graphdriver.Differ, error) {
 	return nil, errors.New("format not supported on this system")
 }
-
-// GetTOCDigest returns the digest of the TOC as recorded in the annotations.
-// This is an experimental feature and may be changed/removed in the future.
-func GetTOCDigest(annotations map[string]string) (*digest.Digest, error) {
-	return nil, errors.New("format not supported on this system")
-}
diff --git a/vendor/github.com/containers/storage/store.go b/vendor/github.com/containers/storage/store.go
index 14c1edd7f8..a31aebfd24 100644
--- a/vendor/github.com/containers/storage/store.go
+++ b/vendor/github.com/containers/storage/store.go
@@ -1459,6 +1459,7 @@ func (s *store) PutLayer(id, parent string, names []string, mountLabel string, w
 	layerOptions := LayerOptions{
 		OriginalDigest:     options.OriginalDigest,
 		UncompressedDigest: options.UncompressedDigest,
+		Flags:              options.Flags,
 	}
 	if s.canUseShifting(uidMap, gidMap) {
 		layerOptions.IDMappingOptions = types.IDMappingOptions{HostUIDMapping: true, HostGIDMapping: true, UIDMap: nil, GIDMap: nil}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 391b36e39e..5ff86d0552 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -321,7 +321,7 @@ github.com/containers/psgo/internal/dev
 github.com/containers/psgo/internal/host
 github.com/containers/psgo/internal/proc
 github.com/containers/psgo/internal/process
-# github.com/containers/storage v1.48.1-0.20230728131509-c3da76fa3f63
+# github.com/containers/storage v1.49.1-0.20230823084450-6902c2df7cca
 ## explicit; go 1.19
 github.com/containers/storage
 github.com/containers/storage/drivers
@@ -800,7 +800,7 @@ github.com/opencontainers/go-digest
 ## explicit; go 1.18
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
-# github.com/opencontainers/runc v1.1.8 => github.com/opencontainers/runc v1.1.1-0.20220617142545-8b9452f75cbc
+# github.com/opencontainers/runc v1.1.9 => github.com/opencontainers/runc v1.1.1-0.20220617142545-8b9452f75cbc
 ## explicit; go 1.17
 github.com/opencontainers/runc/libcontainer/apparmor
 github.com/opencontainers/runc/libcontainer/cgroups